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This listing of claims will replace all prior versions, and listings, of claims in the application: 
Listing of Claims: 

Claim 1 (currently amended): A method suitable for use in a communication device for 
determining the disposition of incoming e-mail from a sender, said method comprising the steps 
of: 

establishing the identity of the sender to provide a sender identifier; 

determining a cumulative penalty count value associated with said sender 

ide ntifier^ wherejn det 

assessing,^ 

activity .perfo 

retrieving a system oj/eraJL.. resource usage status associated with the 

communication device; and 
processing the incoming e-mail on the basis of said cumulative penalty count 

value and said system overall resource usage status. 

Claim 2 (original): The method of claim 1 wherein said step of establishing the identity 
of the sender comprises the step of ascertaining an IP address for the sender. 

Claim 3 (original): The method of claim 1 wherein said step of establishing the identity 
of the sender comprises the step of associating the sender with a peer IP address of the sender 
TCP connection. 

Claim 4 (cancelled) 

Claim 5 (currently amended): The method of claim[[ 4]] 1 wherein said cumulative 
penalty count value comprises an activity penalty count charged to the sender for current 
undesirable sender activity and a time-dependent penalty count determined from previous 
undesirable sender activity. 
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Claim 6 (original): The method of claim 5 wherein said time-dependent penalty count 
comprises a zero value subsequent to a pre-established retention period. 

Claim 7 (currently amended): The method of claim 5 wherein said time-dependent 
penalty count comprises a prior activity penalty count value reduced by a time-dep.^ 
factor. 

Claim 8 (currently amended): The method of claim[[ 4]]„1 wherein said undesirable 
activity comprises a member of the group consisting of sending a large number of e-mails, 
sending emails of relatively large sizes, using a relatively large amount of TCP connection time, 
and causing a TCP timeout. 

Claim 9 (currently amended): The method of claim 1 wherein said system overall 
resource usage status is a function of a member of the group consisting of: the number of 
concurrent TCP connections being maintained, the number of e-mail files in an incoming 
message queue, and the amount of disk space being utilized for an incoming message queue. 

Claim 10 (currently amended): The method of claim 1 wherein said step of processing 
the incoming e-mail comprises the step of assigning an operating state to the communication 
device, said operating state being a function of said system overall resource usage status. 

Claim 1 1 (original): The method of claim 10 wherein said operating state is a member of 
the group consisting of: a normal operating state, a selective-rejection operating sate, and a 
random- rejection operating state. 

Claim 12 (original): The method of claim 1 1 wherein, for said selective-rejection state, if 
said cumulative penalty count value has a zero value, said step of processing the incoming e-mail 
comprises the step of accepting the incoming e-mail. 
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Claim 13 (original): The method of claim 11 wherein, for said selective-rejection state, if 
said cumulative penalty count value has a nonzero value, said step of processing the incoming e- 
mail comprises the steps of: 

specifying a rejection factor, 

generating a random number; and 

randomly rejecting the incoming e-mail on the basis of said rejection factor and 
said random number. 

Claim 14 (original): The method of claim 13 wherein said step of randomly rejecting 
comprises the step of accepting the incoming e-mail if said random number is greater than said 
rejection factor and rejecting the incoming e-mail if said random number is not greater than said 
rejection factor. 

Claim 15 (currently amended): The method of claim 13 wherein said rejection factor is 
increased if said system overall . .resource usage status increases and said rejection factor is 
decreased if said system overall resource usage status decreases. 

Claim 16 (original): The method of claim 11 wherein, for said random-rejection state, if 
said cumulative penalty count value has a nonzero value, said step of processing the incoming e- 
mail comprises the step of rejecting the incoming e-mail. 

Claim 17 (currently amended): The method of claim 11 wherein, for said random- 
rejection state, if said cumulative penalty count value has a zero value, said step of processing 
the incoming e-mail comprises the steps of: 

deriving an overall resource usage factor; 

generating a random number; and 

randomly Meeting rejection- the incoming e-mail on the basis of said overall 
resource usage factor, said random number, and said cumulative penalty count 
value. 



Page 4 of 19 

4/10 * RCVD AT 6/28/20054:27:39 PM [Eastern Daylight Time] * SVR:USPTO-EFXRF-1/8 * DNIS:8729306 * C8ID: 12028243001 * DURATION (mm-ss): 07-28 



12028243001 



6/28/2005 4:28 PAGE 005/019 Fax Server 



Application No.: 09/895,532 

Amendment dated June 28, 2005 

Reply to Office Action of March 28, 2005 

Claim 18 (currently amended): The method of claim 17 wherein said step of randomly 
rejecting comprises the step of accepting the incoming e-mail if said random number is greater 
than a product of said overall resource usage factor and said cumulative penalty count value, and 
rejecting the incoming e-mail if said random number is not greater than said product of said 
overall resource usage factor and said cumulative penalty count value. 

Claim 19 (currently amended): The method of claim 18 wherein said overall, .resource 
usage factor is increased if said a ..system overalL.resource usage status increases and said 
resource usage factor is decreased if said system overall resource usage status decreases. 

Claim 20 (currently amended): A communication device for determining the disposition 
of incoming e-mail from a sender, said device comprising: 
a penalty count filter module having 

means for identifying the sender; 

means for assigning a penalty count to the sender, said penalty count being 

a function of undesirable activity associated with the sender; 
means for determining an overall resource usage value for said 

communication device in receiving e-mail; 
means for specifying an operating state for penalty count filter module, 

said operating state being a function of said overall .resource usage 

value; and 

an accept/reject filter for disposing of the incoming e-mail on the basis of 
said sender penalty count and said operating state. 

Claim 21 (original): The device of claim 20 wherein said means for identifying the 
sender includes means for obtaining at least one of a Domain Name Service verification and a 
peer IP address of the sender TCP connection. 
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Claim 22 (original): The device of claim 20 wherein said undesirable activity comprises 
a member of the group consisting of: sending a large number of e-mails, sending e-mails of 
relatively large sizes, using a relatively large amount of TCP connection time, and causing a TCP 
timeout. 

Claim 23 (currently amended): The device of claim 20 wherein said system overall 
resource usage status-value .is a function of a member of the group consisting of: the number of 
concurrent TCP connections being maintained, the number of e-mail files in an incoming 
message queue, and the amount of disk space being utilized for an incoming message queue. 

Claim 24 (currently amended): A communication device for determining the disposition 
of incoming e-mail from a sender, said device comprising: 

a sender penalty count data structure for storing a current penalty count value 

associated with the sender; 
a system resource usage status file for storing a current usage status value for 

device e-mail processing resources; and 
an accept/reject filter for disposing of the incoming e-mail on the basis of said 
penalty count value and said usage status. 

Claim 25 (original): The device of claim 24 wherein said sender penalty count data 
structure includes an entry comprising a member of the group consisting of: a sender 
identification value, a cumulative penalty count value, a cumulative e-mail count, a total e-mail 
size, a total TCP connection time, and a timestamp value. 
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Claim 26 (currently amended): A method suitable for use in a communication device for 
determining the disposition of incoming e-mail from a sender, said method comprising the steps 

of: 

identifying the e-mail sender by determining a sender IP address; 
obtaining a previous sender penalty count value calculated for said sender IP 
address,..„wherein..^ 

undesir^ and 
accepting or i^ecting,rejeetk>n the incoming e-mail based on said previous sender 
penalty count value. 

Claim 27 (original): The method of claim 26 further comprising the steps of: 
maintaining a behavior trace table entry for the e-mail sender; and 
determining said previous sender penalty count from said behavior trace table. 

Claim 28 (original): The method of claim 27 further comprising the step of updating 
sender behavior values in said trace table entry in response to receipt of a sender e-mail. 

Claim 29 (currently amended): The method of claim 28 wherein said sender behavior 
values include a member of the group consisting of: the number of e-mails, the total size of e- 
mails, and the total time of TCP connection time. 

Claim 30 (currently amended): The method of claim 28 wherein said step of updating 
sender behavior values comprises the steps of: 

reducing said behavior trace table value by a jtinie-d@p@M§.nt..decay factor; and 
adding a current behavior trace table value to said corresponding reduced 
behavior trace table value. 

Claim 31 (currently amended): The method of claim 30 wherein said timerdepen^ent 
decay factor is a function of the time interval between the last two updates of said behavior trace 
table entry and a pre-established retention period. 
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Claim 32 (currently amended): The method of claim 26 wherein said .previous sender 
penalty count value is determined from undesirable sender activity occurring over a pre- 
established retention period. ^ 

Claim 33 (original): The method of claim 32 wherein said undesirable activity comprises 
a member of the group consisting of: sending a large number of e-mails, sending e-mails of 
relatively large sizes, using a relatively large amount of TCP connection time, and causing a TCP 
timeout. 

Claim 34 (currently amended): The method of claim 26 further comprising the step of 
updating said r#eyious sender penalty count value. 

Claim 35 (currently amended): The method of claim 34 wherein said step of updating 
said previous, sender penalty count value comprises the steps of: 

reducing said previous sender penalty count value by a decay factor to yield a 
reduced sender penalty count value, said decay factor being a function of said 
a pre-established retention period; and 
adding an activity penalty count value to said reduced sender penalty count value 
to yield an updated sender penalty count value, said activity penalty count 
value calculated as a function of current sender e-mail activities. 

Claim 36 (currently amended): The method of claim 35 wherein said decay factor is 
further a function of the time interval between calculation of said previous sender penalty count 
value and calculation of said activity penalty count value. 
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Claim 37 (currently amended): A method for by -a communication device for 
determining the disposition of incoming e-mail from a sender, said method comprising steps of: 
establishing an identity of the sender; 

determining a cumulative... penalty count value associated with said identity, 

wherein said cumulative penalty count value is based on J^esj^lp^actiwity 

perforated by.a behavior &f the sender; 
retrieving a system pyeralL re source usage status associated with the 

communication device; and 
processing the incoming e-mail based on the cwnulatiye jienalty count value and 

the system overall resource usage status. 

Claim 38 (previously presented): The method of claim 37, wherein said step of 
establishing the identity of the sender comprises the step of ascertaining an IP address of the 
sender. 

Claim 39 (canceled) 

Claim 40 (currently amended): The method of claim 37, wherein said cumulative penalty 
count value comprises a prior penalty count value reduced by a tim.^<tepsild6D!t..decay factor. 

Claim 41 (currently amended): The method of claim 37 wherein said step of processing 
the incoming e-mail comprises the step of assigning an operating state to the communication 
device, said operating state being a function of said system overall resource usage status. 

Claim 42 (previously presented): The method of claim 41 wherein said operating state is 
a member of the group consisting of: a normal operating state, a selective- rejection operating 
sate, and a random-rejection operating state. 
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Claim 43 (previously presented): The method of claim 41, wherein said operating state 
comprises a selective-rejection state, and wherein if said cumulative penalty count value has a 
zero value, said step of processing the incoming e-mail comprises the step of accepting the 
incoming e-mail. 

Claim 44 (previously presented): The method of claim 41 wherein said operating state 
comprises a selective-rejection state, and wherein if said cumulative penalty count value has a 
nonzero value, said step of processing the incoming e-mail comprises the steps of: 

specifying a rejection factor; 

generating a random number; and 

randomly rejecting the incoming e-mail on the basis of said rejection factor and 
said random number. 

Claim 45 (previously presented): The method of claim 44 wherein said step of randomly 
rejecting comprises the step of accepting the incoming e-mail if said random number is greater 
than said rejection factor and rejecting the incoming e-mail if said random number is not greater 
than said rejection factor. 

Claim 46 (currently amended): The method of claim 44 wherein said rejection factor is 
increased if said system overall resource usage status increases and said rejection factor is 
decreased if said system overall resource usage status decreases. 

Claim 47 (previously presented): The method of claim 41 wherein said operating state 
comprises a random-rejection state, and wherein if said cumulative penalty count value has a 
nonzero value, said step of processing the incoming e-mail comprises the step of rejecting the 
incoming e-mail. 
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Claim 48 (currently amended): The method of claim 41 wherein said operating state 
comprises a random-rejection state, and wherein if said cumulative penalty count value has a 
zero value, said step of processing the incoming e-mail comprises the steps of: 

deriving a resource usage factor; 

generating a random number; and 

randomly rejecting .rejection- the incoming e-mail on the basis of said resource 
usage factor, said random number, and said cumulative penalty count value. 

Claim 49 (previously presented): The method of claim 48 wherein said step of randomly 
rejecting comprises the step of accepting the incoming e-mail if said random number is greater 
than a product of said resource usage factor and said cumulative penalty count value, and 
rejecting the incoming e-mail if said random number is not greater than said product of said 
resource usage factor and said cumulative penalty count value. 

Claim 50 (previously presented): The method of claim 49 wherein said resource usage 
factor is increased if said system overall. resource usage status increases and said resource usage 
factor is decreased if said system overall. resource usage status decreases. 
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